← All cheat sheets

SECURITY ACRONYMS

Plain-text reference · 7 KB. Read it, search it (Ctrl-F) or print it.

A quick-reference glossary of the acronyms that show up in security work -
governance, detection, identity, crypto, cloud and network. Expansions are
written here from scratch; one line each. For full term definitions see the
site glossary; for the ATT&CK taxonomy see MITRE-ATTACK.

GOVERNANCE, RISK & COMPLIANCE#

GRC    Governance, Risk and Compliance
RMF    Risk Management Framework (NIST SP 800-37)
CSF    Cybersecurity Framework (NIST CSF 2.0; functions: Govern, Identify,
       Protect, Detect, Respond, Recover)
ISMS   Information Security Management System (ISO/IEC 27001)
SoA    Statement of Applicability (ISO 27001 control selection)
BIA    Business Impact Analysis
BCP    Business Continuity Plan
DRP    Disaster Recovery Plan
RTO    Recovery Time Objective (how fast you must restore)
RPO    Recovery Point Objective (how much data loss is tolerable)
KRI    Key Risk Indicator
SLA    Service Level Agreement
TPRM   Third-Party Risk Management
DPIA   Data Protection Impact Assessment (GDPR)
DPO    Data Protection Officer
RoPA   Record of Processing Activities (GDPR Art. 30)

REGULATIONS & STANDARDS#

GDPR   General Data Protection Regulation (EU)
NIS2   Network and Information Security Directive 2 (EU)
DORA   Digital Operational Resilience Act (EU financial sector)
CRA    Cyber Resilience Act (EU product security)
PCI DSS Payment Card Industry Data Security Standard
HIPAA  Health Insurance Portability and Accountability Act (US)
SOC 2  System and Organization Controls 2 (AICPA Trust Services)
FISMA  Federal Information Security Modernization Act (US)
FedRAMP Federal Risk and Authorization Management Program (US cloud)
CMMC   Cybersecurity Maturity Model Certification (US DoD)
CIS    Center for Internet Security (Benchmarks, Controls)
STIG   Security Technical Implementation Guide (US DISA)

TEAMS, ROLES & OPERATIONS#

SOC    Security Operations Centre
CERT   Computer Emergency Response Team
CSIRT  Computer Security Incident Response Team
PSIRT  Product Security Incident Response Team
CISO   Chief Information Security Officer
IR     Incident Response
DFIR   Digital Forensics and Incident Response
SOAR   Security Orchestration, Automation and Response
SIEM   Security Information and Event Management
UEBA   User and Entity Behaviour Analytics
MSSP   Managed Security Service Provider
MDR    Managed Detection and Response
TI/CTI (Cyber) Threat Intelligence
TTP    Tactics, Techniques and Procedures
IOC    Indicator of Compromise
IOA    Indicator of Attack
TLP    Traffic Light Protocol (sharing marking)
MTTD   Mean Time To Detect
MTTR   Mean Time To Respond/Remediate

DETECTION & ENDPOINT#

EDR    Endpoint Detection and Response
XDR    Extended Detection and Response (cross-telemetry)
NDR    Network Detection and Response
AV     Antivirus
HIDS   Host-based Intrusion Detection System
NIDS   Network-based Intrusion Detection System
IDS    Intrusion Detection System
IPS    Intrusion Prevention System
FIM    File Integrity Monitoring
DLP    Data Loss Prevention
AMSI   Antimalware Scan Interface (Windows)
ETW    Event Tracing for Windows
CAR    Cyber Analytics Repository (MITRE)

ATTACKS & THREATS#

APT    Advanced Persistent Threat
C2     Command and Control (also C&C)
RAT    Remote Access Trojan/Tool
RCE    Remote Code Execution
LPE    Local Privilege Escalation
XSS    Cross-Site Scripting
CSRF   Cross-Site Request Forgery
SSRF   Server-Side Request Forgery
SQLi   SQL Injection
DoS    Denial of Service
DDoS   Distributed Denial of Service
MITM   Man-in-the-Middle (also AITM, Adversary-in-the-Middle)
BEC    Business Email Compromise
LOLBin Living-Off-the-Land Binary (abused signed tool)
PtH    Pass-the-Hash
PtT    Pass-the-Ticket
CVE    Common Vulnerabilities and Exposures (an ID)
CWE    Common Weakness Enumeration (a bug class)
CVSS   Common Vulnerability Scoring System
EPSS   Exploit Prediction Scoring System (FIRST)
KEV    Known Exploited Vulnerabilities (CISA catalogue)

IDENTITY & ACCESS#

IAM    Identity and Access Management
PAM    Privileged Access Management
SSO    Single Sign-On
MFA    Multi-Factor Authentication (2FA = two-factor)
RBAC   Role-Based Access Control
ABAC   Attribute-Based Access Control
PoLP   Principle of Least Privilege
JIT    Just-In-Time (access)
SAML   Security Assertion Markup Language
OIDC   OpenID Connect (identity layer on OAuth 2.0)
OAuth  Open Authorization (delegated authorization)
SCIM   System for Cross-domain Identity Management (provisioning)
FIDO2  FIDO Alliance standards = W3C WebAuthn + CTAP2 (basis of passkeys)
CIEM   Cloud Infrastructure Entitlement Management

CRYPTO & PKI#

PKI    Public Key Infrastructure
CA     Certificate Authority
CSR    Certificate Signing Request
CRL    Certificate Revocation List
OCSP   Online Certificate Status Protocol
TLS    Transport Layer Security (SSL is its deprecated predecessor)
mTLS   mutual TLS (both sides present certificates)
HSTS   HTTP Strict Transport Security
AES    Advanced Encryption Standard (symmetric)
RSA    Rivest-Shamir-Adleman (asymmetric)
ECC    Elliptic-Curve Cryptography
PFS    Perfect Forward Secrecy
KMS    Key Management Service
HSM    Hardware Security Module
PQC    Post-Quantum Cryptography

NETWORK & EMAIL AUTH#

WAF    Web Application Firewall
NAC    Network Access Control
VPN    Virtual Private Network
ZTNA   Zero Trust Network Access
SASE   Secure Access Service Edge
SSE    Security Service Edge
CASB   Cloud Access Security Broker
DNS    Domain Name System
DNSSEC DNS Security Extensions
SPF    Sender Policy Framework (email)
DKIM   DomainKeys Identified Mail (email)
DMARC  Domain-based Message Authentication, Reporting & Conformance

CLOUD, APPSEC & SUPPLY CHAIN#

CSPM   Cloud Security Posture Management
CWPP   Cloud Workload Protection Platform
CNAPP  Cloud-Native Application Protection Platform
SAST   Static Application Security Testing
DAST   Dynamic Application Security Testing
IAST   Interactive Application Security Testing
SCA    Software Composition Analysis
SBOM   Software Bill of Materials
VEX    Vulnerability Exploitability eXchange
CI/CD  Continuous Integration / Continuous Delivery
IaC    Infrastructure as Code
SDLC   Software Development Life Cycle

THREAT-MODELLING MNEMONICS#

STRIDE Spoofing, Tampering, Repudiation, Information disclosure,
       Denial of service, Elevation of privilege
DREAD  Damage, Reproducibility, Exploitability, Affected users,
       Discoverability (risk-rating; largely historical)
CIA    Confidentiality, Integrity, Availability (the security triad)
AAA    Authentication, Authorization, Accounting

Defensive reference on CyberRamen. Offensive / red-team sheets live on OffensiveRamen.com.